I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header.
† the consent (or rather, intent not to consent) is explicit, and although non-interactive at the site level it was interactive at the browser level until MS defaulted it to `1`. Now I'm wishing it were like those notifications/location/webcam/mic access and the dialogs were required to go through the browser itself.
Then I think that's the best kept secret of the industry.
A law enforcing DNT would be good, but honestly it would change the semantics of the header.
Oh, there's nothing like that in the so-called "HTML standard"? Maybe, just maybe, Google being the standard body might have something to do with it, when Apple have been blocking third-party cookies for years now [1], and is in the progress of banning browser APIs that can be used for fingerprinting.
Best of all, this might rollback all those HTML5 APIs that have no business being shipped with browsers, and bring back the web content we want.
[1]: https://webkit.org/blog/10218/full-third-party-cookie-blocki...
It would be much better to make a browser-side dialog like it's done with location tracking and desktop notifications, and also provide a checkbox in the settings. Most importantly it would take away control from shady websites to implement it on their shady terms(though admittedly giving that control to Google's browser may not be ideal either).